Skip to content
OpenAdvisories

Ecosystem

NuGet

1,172 known vulnerabilities.

Most affected packages

Microsoft.ChakraCore 247 magick.net-q16-anycpu 165 magick.net-q16-hdri-anycpu 165 magick.net-q8-anycpu 165 Magick.NET-Q16-HDRI-x86 163 Magick.NET-Q16-x86 162 Magick.NET-Q8-x86 162 Magick.NET-Q16-HDRI-x64 160 Magick.NET-Q16-OpenMP-x64 160 Magick.NET-Q16-arm64 160 Magick.NET-Q16-OpenMP-arm64 160 Magick.NET-Q16-HDRI-OpenMP-arm64 160 Magick.NET-Q8-arm64 159 Magick.NET-Q8-OpenMP-arm64 159 Magick.NET-Q16-HDRI-arm64 159 magick.net-q8-openmp-x64 157 magick.net-q16-x64 156 magick.net-q8-x64 154 Magick.NET-Q16-HDRI-OpenMP-x64 95 Magick.NET-Q16-OpenMP-x86 68 Microsoft.NETCore.App.Runtime.win-x64 52 Microsoft.NETCore.App.Runtime.win-arm64 51 Microsoft.NETCore.App.Runtime.win-x86 51 Microsoft.AspNetCore.App.Runtime.win-x64 47 Microsoft.AspNetCore.App.Runtime.win-x86 46 Microsoft.NETCore.App.Runtime.linux-x64 44 Microsoft.NETCore.App.Runtime.linux-arm 43 Microsoft.NETCore.App.Runtime.linux-arm64 43 Microsoft.NETCore.App.Runtime.linux-musl-arm64 43 Microsoft.NETCore.App.Runtime.linux-musl-x64 43 Microsoft.AspNetCore.App.Runtime.win-arm64 43 Microsoft.AspNetCore.App.Runtime.linux-x64 42 Microsoft.NETCore.App.Runtime.osx-x64 41 Microsoft.AspNetCore.App.Runtime.linux-arm 41 Microsoft.AspNetCore.App.Runtime.linux-arm64 41 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 41 Microsoft.AspNetCore.App.Runtime.osx-x64 41 Microsoft.NETCore.App.Runtime.linux-musl-arm 41 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 40 Microsoft.AspNetCore.App.Runtime.linux-musl-arm 36
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 10.0
    CVE-2025-64095 Public exploit Scanner template EPSS 47%

    DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite

    DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. An unauthenticated use…

    dnnsoftware Dnn.Platform Dnn.Platform NuGet
  • Critical 9.9
    CVE-2025-55315 Public exploit EPSS 67%

    ASP.NET Security Feature Bypass Vulnerability

    Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

    Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft Visual Studio 2022 version 17.12 Microsoft Visual Studio 2022 version 17.10 Ubuntu Alpine Wolfi NuGet
  • Critical 9.1
    CVE-2024-48510 Public exploit

    DotNetZip Directory Traversal vulnerability

    Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component NOTE: This vulnerability only affects products that are no longer supported by the maint…

    DotNetZip ProDotNetZip NuGet
  • Critical 9.8
    CVE-2023-32571 Public exploit EPSS 35%

    Dynamic Linq vulnerable to remote code execution

    Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.

    System.Linq.Dynamic.Core NuGet
  • Critical 9.8
    CVE-2021-46703 Public exploit

    Code injection in RazorEngine

    In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandboxed environment (if users can externally control template contents). NOTE: This vulnerability only affects products that…

    RazorEngine NuGet
  • Critical 9.6
    CVE-2020-15999 Exploited Public exploit EPSS 64%

    Heap buffer overflow in CefSharp

    Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

    Google Chrome chromium-browser firefox-esr Browsers Debian Ubuntu Azure Linux Alpine NuGet
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2018-1285 Public exploit EPSS 18%

    XML External Entity attack in log4net

    Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

    log4net log4net log4net Debian Ubuntu NuGet
  • Critical 9.8
    CVE-2015-2794 Public exploit Scanner template EPSS 75%

    The installation wizard in DotNetNuke (DNN) allows privilege escalation

    The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.

    DotNetNuke.Core NuGet